Log in Start free

Vulnerability · Published Sep 3, 2020 · Assigned by redhat

CVE-2020-14373

Medium 5.5

In plain English

A medium-severity use-after-free in ghostscript. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.5%top 60.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a specially crafted PDF file to cause a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8ghostscript9.27-1.el8ALSA-2021:1852
AlmaLinux:8ghostscript-doc9.27-1.el8ALSA-2021:1852
AlmaLinux:8ghostscript-tools-dvipdf9.27-1.el8ALSA-2021:1852
AlmaLinux:8ghostscript-tools-fonts9.27-1.el8ALSA-2021:1852
AlmaLinux:8ghostscript-tools-printing9.27-1.el8ALSA-2021:1852
AlmaLinux:8ghostscript-x119.27-1.el8ALSA-2021:1852
AlmaLinux:8libgs9.27-1.el8ALSA-2021:1852
AlmaLinux:8libgs-devel9.27-1.el8ALSA-2021:1852
Debian:12ghostscript9.26~dfsg-1DEBIAN-CVE-2020-14373
Debian:13ghostscript9.26~dfsg-1DEBIAN-CVE-2020-14373
Debian:14ghostscript9.26~dfsg-1DEBIAN-CVE-2020-14373
Rocky Linux:8ghostscript0:9.27-1.el8RLSA-2021:1852
Rocky Linux:8ghostscript0:9.27-11.el8RLSA-2021:1852

Affected products (as reported)

VendorProductVersions
n/a ghostscript 9.25

Weakness: CWE-416

References